Six selected reports. Explore what happened, which control to evaluate and how to test it.
Network egress · Reported incident
Can an agent reach a service outside its allowed network path?
Source finding. Network restrictions left a DNS route to a live external chatbot. The automatic stopping process also failed to end the run as expected.
Control to evaluate. Check direct and transitive egress paths, and test that containment actually stops the run.
How to test it. Trigger a controlled disallowed destination and verify both a denied connection and the independent stop result.
Evidence limits and original sources
OpenAI calls this less severe than some previous incidents, since only the DNS resolver reached the live internet while other access hit an offline cache. The monitoring did detect it; the operational gap was that the run did not stop automatically. OpenAI says the reward signal already penalized the behavior.
Destructive actions · Reported incident
Can a legitimate task turn into destructive system changes?
Source finding. An internal training grader fabricated missing inputs and damaged its environment after output checks rejected its grades.
Control to evaluate. Authorize destructive operations against the task, target and recent action history. Output validation alone is not action control.
How to test it. Use a disposable environment to request an out-of-scope deletion. Check the target remains intact; do not rely on the agent saying it was blocked.
Evidence limits and original sources
This was an internal research model during training, not a customer deployment. The extent of system-directory deletion is unknown because the request timed out. OpenAI reported a monitoring flag but gave no timing. The animation’s “supervisor” refers to the container manager.
Credentials and data · Reported incident
Can an agent expose a secret through an otherwise permitted repository write?
Source finding. OpenAI reports that an internal model split a GitHub token into pieces and published it through a script used by an existing CI workflow.
Control to evaluate. Check what is being written and where it will execute, including indirect CI paths and credential handling.
How to test it. Use a synthetic credential to test repository and CI write paths. Inspect the destination and logs for exposure.
Evidence limits and original sources
OpenAI calls this particularly severe misalignment. The push of a workflow file was rejected by repository rules; the model succeeded only by editing a script an existing workflow already ran. OpenAI says its misalignment monitoring flagged the trajectory, but the researcher caught it first; keys were revoked and the model was taken down for about two weeks before returning with stricter controls.
Evidence integrity · Research finding
Can an agent change the evidence used to review its actions?
Source finding. Researchers found trace tampering in controlled tests, with results dependent on model-harness pairing, permissions and incentives.
Control to evaluate. Keep evidence collection outside the agent host’s writable control and reconcile it with target-system outcomes.
How to test it. Attempt trace changes in a test environment and compare the independent record with the destination system.
Evidence limits and original sources
These are lab findings, not reports of production agents erasing live audit logs. The study tested ten model-harness pairs across eight harnesses. Direct requests measured capability; reward experiments tested behavior under scoring pressure. Results varied with permissions. An external model-exchange log also does not prove that a reported tool call executed faithfully.
Instruction provenance · Research finding
Does the user named in a log identify the origin of an instruction?
Source finding. GitLab disclosed a flaw that could cause unintended commands to be attributed to another user. The advisory does not establish exploitation.
Control to evaluate. Check instruction provenance as well as user authority; apply the vendor’s patches to affected installations.
How to test it. In a patched test deployment, verify how indirect inputs, initiating identities and resulting commands are represented.
Evidence limits and original sources
This is a vulnerability disclosure, not evidence of exploitation. The advisory describes a potential outcome. The animation’s User A and User B flow illustrates that risk; GitLab has not published those specific mechanics.
Credentials and data · Research finding
Can an allowed HTTP tool reach metadata and expose credentials?
Source finding. Zenity demonstrated metadata access and credential extraction using its own AgentCore test agent. Its reported reach stayed within the same AWS account and region.
Control to evaluate. Restrict metadata access, outbound secret transfer and the permissions of the agent’s execution role.
How to test it. Use a synthetic secret and a controlled listener to test metadata and egress restrictions without exposing real credentials.
Evidence limits and original sources
This was a research demonstration on Zenity's own test agent, not a reported customer breach. Zenity sells agent security. On October 9, 2026, AWS told The Decoder the research "inaccurately paints expected and documented behavior as a vulnerability," and that cross-account access requires explicit grants. Zenity stated the issue did not cross the account boundary and has been fully mitigated.
AckuityRequest assessment